Handling malware on server

So I've been dealing with a program that I believe is malicious. I would't be surprised if someone had previously accessed my server b/c I had a poorly configured ssh server that was accessible outside of the local network.

Regardless, this program is using all threads of my CPU at 100%. If I'm monitoring CPU usage before the application starts with HTOP then it shows that ~10 processes spawn that all show commands that seem to all be identifying command such as WHO and UPTIME.

Shortly after these commands show up all input is halted b/c the CPU is maxed out. If I kill the first process that spawned all the "copy processes" are killed too. But the processes all come back within seconds to 20 minutes.

My temporary solution was to wait for the processes to show up and SIGSTOP but recently the application either takes up all resources before I can stop it or I end up waiting 20+ minutes for the application to show up. I have tried waiting for computer to unfreeze but to no avail even after hours of waiting.

I have tried booting in to the recovery mode (probably not the right name) by holding left shift but the screen just flickers and eventually just starts the normal boot process.

I'm able to get use the server for a very short time after it starts up and wanted to know if there is anything I can do within this time that would allow me to create a back up?

I don't think that removing the malware is an option b/c I have been able to find the file that starts the processes but after I deleted it is created again under a different random name (just a random combination letters and possibly number).

On a side note what kind of malware do you think this is? I have a hunch it's a E-coin miner but it's just a hunch.

Thanks